topic Re: extracting response status time in Splunk Search

extracting response status time

mammefen — Wed, 30 Sep 2020 01:08:14 GMT

How can i extract the the http_response_time so that i can get the max(HTTP_STATUS_RESPONSE), MIN(HTTP_STATUS_RESPONSE) and median(HTTP_STATUS_RESPONSE). from the following events

6/28/19 9:05:26.760 AM INFO 2019-06-28 05:05:26,760 ------- [[------_rrfi.zip].throttling-task.01] LoggerMessageProcessor AFTER: IP_address: ....... API_name: ........ server ip :......... trace id: ------location: en_US {http.status=200, Content-Type=application/json;charset=UTF-8}

6/28/19 4:08:52.952 PM INFO 2019-06-28 12:08:52,952 -------[[-------_rrfi.zip].throttling-task.01] LoggerMessageProcessor  BEFORE: IP_address: null API_name:-------server ip: -----trace id: ------ location: en_US

Re: extracting response status time

richgalloway — Wed, 30 Sep 2020 01:08:17 GMT

Where is the http_response_time field in those events?
Do you want to do the extraction at index time or search time?

Re: extracting response status time

mammefen — Wed, 30 Sep 2020 01:08:20 GMT

i want to extract the duration of the the response from the beginning to the end event log as "HTTP_STATUS_RESPONSE" so, i did not extract the http_status_response yet .but i have to substract 9:05:26-4:08:52, to get the duration.

Re: extracting response status time

richgalloway — Wed, 30 Sep 2020 01:08:23 GMT

Assuming trace id is unique for a transaction and is extracted as trace_id, try this query:

index = foo | stats earliest(_time) as start, latest(_time) as end, values(http.status) as http_status, value(server_ip) as server_ip by trace_id | eval http_response_time = tostring(end - start, "duration")

Re: extracting response status time

mammefen — Wed, 30 Sep 2020 01:08:26 GMT

Thank you for your best answer . so, i want to create this http_status_time as a field and use it for another search like to get the MIN(http_response_time ) , MAX(http_response_time ) and median(http_response_time ) for each api and for each month?